https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T17:51:44.244923+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-41205 CVE-2026-41205 — Mako: Path traversal via double-slash URI prefix in TemplateLookup 2026-10-02T17:51:44.260419+00:00

Affected: sqlalchemy mako

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.